diff --git a/netwerk/protocol/http/nsHttpTransaction.cpp b/netwerk/protocol/http/nsHttpTransaction.cpp
index 02e1c43c5a4..4d5b8f14320 100644
--- a/netwerk/protocol/http/nsHttpTransaction.cpp
+++ b/netwerk/protocol/http/nsHttpTransaction.cpp
@@ -306,6 +306,19 @@ nsresult nsHttpTransaction::Init(
     mHasRequestBody = false;
   }
 
+  // The originating channel keeps its own reference to this upload stream and
+  // may seek or clone it on the main thread (to rewind for a 307/308 redirect
+  // or an auth retry) while this transaction reads it on the socket thread.
+  // Input streams are not safe for concurrent access from multiple threads, so
+  // read from a private clone and leave the channel's stream untouched by the
+  // socket thread. Parent-process upload streams are normalized to be cloneable
+  // (see HttpBaseChannel's NormalizeUploadStream).
+  nsCOMPtr<nsIInputStream> requestBodyClone;
+  if (mHasRequestBody && NS_SUCCEEDED(NS_CloneInputStream(
+                             requestBody, getter_AddRefs(requestBodyClone)))) {
+    requestBody = requestBodyClone;
+  }
+
   requestContentLength += mReqHeaderBuf.Length();
 
   if (mHasRequestBody) {